---
title: "Understanding Vulnerability States"
slug: "understanding-vulnerability-states"
updated: 2026-10-22T15:02:28Z
published: 2026-10-22T15:02:28Z
canonical: "docs.safe.security/understanding-vulnerability-states"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Understanding Vulnerability States

In Balbix, vulnerability states reflect where each vulnerability stands in the remediation process. These states appear in dashboards, filters, and vulnerability details to help you prioritize efforts, track progress, and evaluate exposure.

> Note: In the Balbix UI, these are referred to as “instance states.”

Balbix defines the following vulnerability states:

### Active

The vulnerability has been confirmed and poses an active risk. It has not been mitigated or remediated. This includes vulnerabilities with known exploits, critical CVEs, and any weaknesses that remain exposed in your environment.

### Mitigated

The vulnerability is still present, but compensating controls have been applied to reduce its risk. This could involve disabling a feature, isolating the system, applying a WAF rule, or any other measure that reduces exploitability without applying a full fix.

### Remediated

The vulnerability has been resolved on the affected asset. This typically means a patch or configuration fix has been successfully applied and verified. Vulnerability states are assigned per instance, meaning the same vulnerability can be in different states across different assets, and even across different instances on the same asset.

### Unconfirmed

The presence of the vulnerability is suspected but not yet verified. This might be due to incomplete scan data, a mismatch between inventory and patching records, or a newly disclosed issue that has not yet been fully assessed.

### Understanding State Distribution

The same vulnerability can exist in different states across your environment. For example:

- **Remediated** on production servers
- **Mitigated** on legacy systems
- **Active** on development environments
- **Unconfirmed** in recently added assets pending scan

Balbix tracks these states per asset, allowing both horizontal views (across all assets for a given CVE) and vertical views (all vulnerabilities on a given asset).

### Summary

Balbix uses four vulnerability states to describe the current disposition of each issue:

- **Active** – Confirmed and still exposed
- **Mitigated** – Risk reduced through compensating controls
- **Remediated** – Fully resolved through a fix
- **Unconfirmed** – Not yet verified

> ### See Also:
> 
> [Understanding Product States](/balbixhelp/docs/understanding-product-states)